@algolia/transporter
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher change reflects a legitimate Algolia org-level maintainer rotation; eric-zaharia has 213 approved packages across the Algolia ecosystem, consistent with an internal team transition. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers eric-zaharia and fluf are part of an Algolia org-wide rotation, not an isolated package takeover. eric-zaharia has a strong track record of 213 approved packages. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of millotp is consistent with the same org-level maintainer rotation across Algolia packages, not indicative of a hostile takeover. | ai | |
| dependencies | unvetted-dep:@algolia/cache-common | AI (dependencies): First-party Algolia sibling package from the same monorepo, always released at the same pinned version. Not a third-party risk. | ai | |
| provenance | no-provenance | AI (provenance): Algolia JS client monorepo does not use Sigstore provenance; absence is consistent across all versions and not a security concern for this well-established package. | ai | |
| dependencies | unvetted-dep:@algolia/logger-common | AI (dependencies): First-party Algolia sibling package from the same monorepo, always released at the same pinned version. Not a third-party risk. | ai | |
| dependencies | unvetted-dep:@algolia/requester-common | AI (dependencies): First-party Algolia sibling package from the same monorepo, always released at the same pinned version. Not a third-party risk. | ai |
Versions (showing 63 of 63)
| Version | Deps | Published |
|---|---|---|
| 4.27.0 | 3 / 0 | |
| 4.26.0 | 3 / 0 | |
| 4.25.3 | 3 / 0 | |
| 4.25.2 | 3 / 0 | |
| 4.25.1 | 3 / 0 | |
| 4.25.0 | 3 / 0 | |
| 4.24.0 | 3 / 0 | |
| 4.23.3 | 3 / 0 | |
| 4.23.2 | 3 / 0 | |
| 4.23.1 | 3 / 0 | |
| 4.23.0 | 3 / 0 | |
| 4.22.1 | 3 / 0 | |
| 4.22.0 | 3 / 0 | |
| 4.21.1 | 3 / 0 | |
| 4.21.0 | 3 / 0 | |
| 4.20.0 | 3 / 0 | |
| 4.19.1 | 3 / 0 | |
| 4.19.0 | 3 / 0 | |
| 4.18.0 | 3 / 0 | |
| 4.17.2 | 3 / 0 | |
| 4.17.1 | 3 / 0 | |
| 4.17.0 | 3 / 0 | |
| 4.16.0 | 3 / 0 | |
| 4.15.0 | 3 / 0 | |
| 4.14.3 | 3 / 0 | |
| 4.14.2 | 3 / 0 | |
| 4.14.1 | 3 / 0 | |
| 4.14.0 | 3 / 0 | |
| 4.13.1 | 3 / 0 | |
| 4.13.0 | 3 / 0 | |
| 4.12.2 | 3 / 0 | |
| 4.12.1 | 3 / 0 | |
| 4.12.0 | 3 / 0 | |
| 4.11.0 | 3 / 0 | |
| 4.10.5 | 3 / 0 | |
| 4.10.4 | 3 / 0 | |
| 4.10.3 | 3 / 0 | |
| 4.10.2 | 3 / 0 | |
| 4.10.0 | 3 / 0 | |
| 4.9.3 | 3 / 0 | |
| 4.9.2 | 3 / 0 | |
| 4.9.1 | 3 / 0 | |
| 4.9.0 | 3 / 0 | |
| 4.8.6 | 3 / 0 | |
| 4.8.5 | 3 / 0 | |
| 4.8.4 | 3 / 0 | |
| 4.8.3 | 3 / 0 | |
| 4.8.2 | 3 / 0 | |
| 4.8.1 | 3 / 0 | |
| 4.8.0 | 3 / 0 | |
| 4.7.0 | 3 / 0 | |
| 4.6.0 | 3 / 0 | |
| 4.5.1 | 3 / 0 | |
| 4.5.0 | 3 / 0 | |
| 4.4.0 | 3 / 0 | |
| 4.3.1 | 3 / 0 | |
| 4.3.0 | 3 / 0 | |
| 4.2.0 | 3 / 0 | |
| 4.1.0 | 3 / 0 | |
| 4.0.3 | 3 / 0 | |
| 4.0.2 | 3 / 0 | |
| 4.0.1 | 3 / 0 | |
| 4.0.0 | 3 / 0 |
v4.27.0
2 findingsThis version was published by a different npm account than previous versions on 2026-02-27. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.26.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-02-17. This could indicate a legitimate maintainer transition or an account compromise.
v4.25.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.25.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.25.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.25.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.24.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.23.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.23.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.23.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.23.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.22.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.22.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.21.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.21.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.20.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.19.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.19.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.18.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.17.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.17.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.17.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.16.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-03-23. This could indicate a legitimate maintainer transition or an account compromise.
v4.15.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-03-02. This could indicate a legitimate maintainer transition or an account compromise.
v4.14.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.14.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.14.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.14.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.12.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.12.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.12.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.11.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.7.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.